IN THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1 . (Previously Presented) A method for identifying network traffic comprising: 

receiving pattem matching data; 

comparing the pattem matching data with each of a plurality of patterns; 
for each pattem, determining whether the pattem matching data matches 

the pattem; 

for each pattem that the pattem matching data is determined to match, 
including a pattem match score corresponding to the pattem in an application protocol 
score associated with an application protocol with which the pattem is associated, - 
wherein the application protocol comprises one of a plurality of application protocols and 
each pattem is associated with a corresponding one of the plurality of application 
protocols; and 

concluding that a network traffic with which the pattem matching data is 
associated is associated with a determined application protocol that has a highest 
application protocol score among the plurality of application protocols. 

2. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
pattem matching data includes application data. 

3. (Original) A method for identifying network traffic as recited in Claim 1, in the event that 
the pattem matching data matches the pattem, further including determining a property 
associated with the network traffic. 

4. (Canceled) 
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5. (Original) A method for identifying network traffic as recited in Claim 1, in the event that 
the data matches the pattern, further including determining a property associated with the data 
and assigning a score for the property. 

6. (Original) A method for identifying network traffic as recited in Claim 1 , in the event that 
the data matches the pattern, further including determining a property associated with the data; 
and applying a policy based on the property. 

7. (Canceled) 

8. (Canceled) 

9. (Canceled) 

1 0. (Original) A method for identifying network traffic as recited in Claim 1 , wherein the 
pattern matching data includes a string selected from a packet. 

1 1 . (Original) A method for identifying network traffic as recited in Claim 1 , wherein pattern 
matching data includes concatenated application data of a plurality of packets. 

12. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
pattem includes a regular expression. 

13. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
pattem includes application protocol information. 

14. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
pattem includes commonly used port information. 

15. (Original) A method for identifying network traffic as recited in Claim 1 , in the event the 
data does not match the pattem, further comprising returning a failure indicator. 

16. (Currently Amended) A method for identifying network traffic as recited in Claim 1, 
wherein the step of determining whether the pattem matching data matches the pattem occurs is 
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performed at the beginning of a session with respect to packets received at the beginning of the 
session. 

17. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
comparing the pattern matching data with a pattern is performed for each received data. 

18. (Canceled) 

19. (Canceled) 

20. (Previously Presented) A system for identifying network traffic comprising: 

an interface configured to receive pattern matching data; 
a processor configured to: 

compare the pattern matching data with each of a plurality of 

patterns; 

for each pattern, determine whether the pattern matching data 
matches the pattern; 

for each pattem that the pattern matching data is determined to 
match, include a pattem match score corresponding to the pattem in an 
application protocol score associated with an application protocol with which the 
pattem is associated, wherein the application protocol comprises one of a plurality 
of application protocols and each pattem is associated with a corresponding one 
of the plurality of application protocols; and 

conclude that a network traffic with which the pattem matching 
data is associated is associated with a determined application protocol that has a 
highest application protocol score among the plurality of application protocols. 
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21 . (Previously Presented) A computer program product for identifying network traffic, the 
computer program product being embodied in a tangible computer readable storage medium and 
comprising computer instructions for: 

receiving pattern matching data; 

comparing the pattern matching data with each of a plurality of patterns; 
for each pattern, determining whether the pattem matching data matches 

thepattem; 

for each pattem that the pattem matching data is determined to match, 
including a pattem match score corresponding to the pattem in an application protocol 
score associated with an application protocol with which the pattem is associated, 
wherein the application protocol comprises one of a plurality of application protocols and 
each pattem is associated with a corresponding one of the plurality of application 
protocols; and 

concluding that a network traffic with which the pattem matching data is 
associated is associated with a determined application protocol that has a highest 
application protocol score among the plurality of application protocols. 

22. (Canceled) 

23. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the pattem matching data includes application data. 

24 (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the processor is further configured to determine a property associated with the network 
traffic in the event that the pattem matching data matches the pattem. 
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25. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the processor is further configured to determine a property associated with the data and 
assign a score for the property in the event that the data matches the pattern. 

26. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the processor is fiirther configured to determine a property associated with the data and 
apply a policy based on the property in the event that the data matches the pattem. 

27. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the pattem matching data includes a string selected from a packet. 

28. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein pattem matching data includes concatenated application data of a plurality of packets. 

29. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the pattem includes a regular expression. 

30. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the pattem includes application protocol information. 

3 1 . (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the pattem includes commonly used port information. 

32. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the processor is further configured to return a failure indicator in the event the data does 
not match the pattem. 

33. (Currently Ahiended) A system for identifying network traffic as recited in Claim 20, 
wherein the processor is configured to determine at the beginning of a session whether the 
pattem matching data matches the pattem at th e b e ginning of a ses sion . 
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34. (Previously Presented) A system for identifying network traffic as recited in Claim 20, 
wherein the processor is configured to compare the pattem matching data with a pattern for each 
received data. 

35. (Previously Presented) A computer program product as recited in Claim 21, wherein the 
pattem matching data includes application data. 

36. (Previously Presented) A computer program product as recited in Claim 21 , further 
comprising computer instructions for determining a property associated with the network traffic 
in the event that the pattem matching data matches the pattem. 

37. (Previously Presented) A computer program product as recited in Claim 2 1 , further 
comprising computer instmctions for determining a property associated with the data and 
assigning a score for the property in the event that the data matches the pattem. 

38. . (Previously Presented) A computer program product as recited in Claim 21 , further 
comprising computer instructions for determining a property associated with the data; and 
applying a policy based on the property in the event that the data matches the pattem. 

39. (Previously Presented) A computer program product as recited in Claim 21, wherein the 
pattem matching data includes a string selected from a packet. 

40. (Previously Presented) A computer program product as recited in Claim 21 , wherein 
pattem matching data includes concatenated application data of a plurality of packets. 

41 . (Previously Presented) A computer program product as recited in Claim 21 , wherein the 
pattem includes a regular expression. 

42. (Previously Presented) A computer program product as recited in Claim 21, wherein the 
pattem includes application protocol information. 

43. (Previously Presented) A computer program product as recited in Claim 2 1 , wherein the 
pattem includes commonly used port information. 
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44. (Previously Presented) A computer program product as recited in Claim 21, further 
comprising computer instructions for returning a failure indicator in the event the data does not 
match the pattem. 

45. (Currently Amended) A computer program product as recited in Claim 2 1 , wherein the 
step of determining whether the pattem matching data matches the pattem occurs is performed at 
the beginning of a session with respect to packets received at the beginning of the session ! 

46. . (Previously Presented) A computer program product as recited in Claim 2 1 , wherein 
comparing the pattem matching data with a pattem is performed for each received data. 
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